Protobuf

Latest version: v6.30.2

Safety actively analyzes 723177 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 13 of 31

21.8

Other
* Fix for grpc.tools 17995 & protobuf 7474 (handle UTF-8 paths in argumentfile) (10721)

C++
* 21.x No longer define no_threadlocal on OpenBSD (10743)

Java
* Mark default instance as immutable first to avoid race during static initialization of default instances (10771)

Ruby
* Auto capitalize enums name in Ruby (10454) (10763)

21.7

Java
* Refactoring java full runtime to reuse sub-message builders and prepare to
migrate parsing logic from parse constructor to builder.
* Move proto wireformat parsing functionality from the private "parsing
constructor" to the Builder class.
* Change the Lite runtime to prefer merging from the wireformat into mutable
messages rather than building up a new immutable object before merging. This
way results in fewer allocations and copy operations.
* Make message-type extensions merge from wire-format instead of building up
instances and merging afterwards. This has much better performance.
* Fix TextFormat parser to build up recurring (but supposedly not repeated)
sub-messages directly from text rather than building a new sub-message and
merging the fully formed message into the existing field.
* This release addresses a [Security Advisory for Java users](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2)

21.6

C++
* Reduce memory consumption of MessageSet parsing
* This release addresses a [Security Advisory for C++ and Python users](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf)

21.5

PHP
* Added getContainingOneof and getRealContainingOneof to descriptor.
* fix PHP readonly legacy files for nested messages

Python
* Fixed comparison of maps in Python.

21.4

C++
* Reduce the required alignment of ArenaString from 8 to 4 (10298)

21.3

C++
* Add header search paths to Protobuf-C++.podspec (10024)
* Fixed Visual Studio constinit errors (10232)
* Fix 9947: make the ABI compatible between debug and non-debug builds (10271)

UPB
* Allow empty package names (fixes behavior regression in 4.21.0)
* Fix a SEGV bug when comparing a non-materialized sub-message (10208)
* Fix several bugs in descriptor mapping containers (eg. descriptor.services_by_name)
* for x in mapping now yields keys rather than values, to match Python conventions and the behavior of the old library.
* Lookup operations now correctly reject unhashable types as map keys.
* We implement repr() to use the same format as dict.
* Fix maps to use the ScalarMapContainer class when appropriate
* Fix bug when parsing an unknown value in a proto2 enum extension (protocolbuffers/upb717)

PHP
* Add "readonly" as a keyword for PHP and add previous classnames to descriptor pool (10041)

Python
* Make //:protobuf_python and //:well_known_types_py_pb2 public (10118)

Bazel
* Add back a filegroup for :well_known_protos (10061)

Page 13 of 31

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.